Executive brief
OpenProject is an open-source project management platform used by teams to track tasks and collaborate. A security flaw in the meetings filter feature allows logged-in users to discover the full names of other users and confirm if specific accounts exist. This could be used by an attacker to map out an organization's employee list or prepare for targeted phishing attacks.
Technical details
An information disclosure vulnerability exists in OpenProject's meetings filter feature due to improper access control (CWE-639). By manipulating the 'invited_user_id' value within the 'filters' GET parameter on the meetings endpoint, an authenticated attacker can probe user IDs. The server's response reveals whether a user ID is valid and discloses the associated user's full name. This allows for full account enumeration of the platform. The issue is fixed in versions 17.3.2 and 17.4.0.
Affected products
- opf OpenProject < 17.3.2, < 17.4.0
Timeline
- 2026-05-13: advisory: GitHub Security Advisory published by vendor
- 2026-06-26: disclosed: CVE published to NVD